{"cvss":7.2,"datePublished":"2020-02-27T00:00:00Z","dateUpdated":"2020-02-27T00:00:00Z","description":"The Flexible Checkout Fields for WooCommerce  plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored.","dueDate":"","id":"CVE-2020-36731","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"flexible_checkout_fields","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"wpdesk flexible_checkout_fields Improper Neutralization of Input During Web Page Generation","vendor":"wpdesk"}